Is CVE-2023-30620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-30620 being exploited in the wild.

How severe is CVE-2023-30620?

Low severity, with a CVSS score of 3.1, published 21 April 2023.

Which products and versions are affected?

mindsdb (PyPI) ECOSYSTEM:introduced=0,fixed=23.2.1.0, GIT:introduced=0,fixed=4419b0f0019c000db390b54d8b9d06e1d3670039|ECOSYSTEM:introduced=0,fixed=23.2.1.0.

Is there a fix for CVE-2023-30620?

Yes. mindsdb (PyPI): upgrade to 23.2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-30620 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-30620?

Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-30620: MindsDB arbitrary file write via path traversal in tarball extraction

CVE-2023-30620 · Severity: low · CVSS 3.1 · Published 2023-04-21

MindsDB is an open-source AI/ML platform that allows users to upload and extract archive files (tarballs). The application downloads remote tarballs and extracts them without validating file paths, allowing an attacker to craft a malicious tarball that writes files outside the intended directory. An attacker could overwrite critical system files, potentially compromising server integrity and availability.

Technologies: mindsdb (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-30620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-30620 being exploited in the wild.
How severe is CVE-2023-30620?: Low severity, with a CVSS score of 3.1, published 21 April 2023.
Which products and versions are affected?: mindsdb (PyPI) ECOSYSTEM:introduced=0,fixed=23.2.1.0, GIT:introduced=0,fixed=4419b0f0019c000db390b54d8b9d06e1d3670039|ECOSYSTEM:introduced=0,fixed=23.2.1.0.
Is there a fix for CVE-2023-30620?: Yes. mindsdb (PyPI): upgrade to 23.2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-30620 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-30620?: Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mindsdb (PyPI): upgrade to 23.2.1.0 or later
```
pip install "mindsdb>=23.2.1.0"
```

Technical details

The vulnerability is a path traversal flaw (CWE-22, also known as TarSlip) in MindsDB's file extraction functionality in file.py. The application uses tarfile.extractall() to extract remotely retrieved tarballs without sanitizing or validating member file paths. An attacker can craft a tarball containing entries with path traversal sequences (e.g., "../../../../etc/passwd") or absolute paths that cause files to be written outside the intended extraction directory. The attack requires network access to the MindsDB API's PUT endpoint and the ability to serve a malicious tarball remotely. No authentication bypass is needed if the endpoint is publicly accessible. The fix was released in version 23.2.1.0.

Affected products

MindsDB MindsDB before 23.2.1.0

Identifiers

CVE-2023-30620
GHSA-2g5w-29q9-w6hx
PYSEC-2023-27

Timeline

2023-03-30: disclosed
2023: patched: Fixed in version 23.2.1.0

References

https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.